NSD 4.15.3 fixes four zone-parsing overwrites that allow command execution on authoritative DNS servers

What shipped

NLnet Labs published NSD 4.15.3 on 14 October 2026, closing four vulnerabilities that affect versions 4.10.0 through 4.15.2. According to a write-up on dev.to, the flaws are tracked as CVE-2026-101337, CVE-2026-101338, CVE-2026-101339 and CVE-2026-101341. All four are stack overwrites that occur while NSD parses zone files, and the vendor describes each as exploitable for the execution of arbitrary commands. The prerequisite in every case is a crafted zone file delivered directly to the parser. SecurityOnline, cited in the same write-up, reports a CVSS v4 score of 8.7, with no public exploit code and no confirmed exploitation in the wild.

Why an authoritative server raises the stakes

The dev.to piece argues that a vulnerability report which stops at the vulnerable process understates the problem for authoritative DNS. An authoritative server holds the zone data for every domain it serves and produces the answers that recursive resolvers cache, so compromising that process has three compounding effects:

• Disclosure. Zone contents can include records describing internal services, along with delegation and DNSSEC material.
• Answer integrity. A compromised server can return records the domain owner never published. Because resolvers cache answers for the record's TTL, forged responses persist after the attacker is gone, and stale caches carry the damage beyond the immediate network.
• Propagation. A modified primary can push poisoned content to healthy secondaries through ordinary AXFR or IXFR transfers, which the secondaries then serve as authoritative.

Who should patch first

The vendor's constraint narrows the patch order. Zone files that NSD itself writes, such as those a secondary saves after a transfer, will not be formatted the way these attacks require. The highest-priority deployments are therefore the ones parsing zone files produced elsewhere. Managed DNS platforms that render customer input through panel software top the urgency list, followed by primaries fed by templates or scripts in a deployment pipeline. Administrator-maintained internal primaries rank medium, secondaries that only accept transfers from a peer NSD rank lower, and lab or staging environments rank medium where the test tooling is shared.

Even the lower rows deserve the upgrade, the write-up stresses, because write access to the zone directory is enough to plant a malicious file. Any account that can write there becomes a route into the parser.

Signals worth watching

Memory corruption in a parser rarely produces a clean error; it produces a crash, a supervisor restart, or a daemon that dies during a reload. The write-up recommends collecting three signals now: unexpected exits of the NSD service with timestamps correlated to zone reloads; supervisor or container restart counts, with alerts on any restart that coincides with a zone change; and reload events triggered by accounts that normally never touch DNS, which can indicate a compromised provisioning credential. Running the nsd-checkzone utility from 4.15.3 against production zones before the upgrade also shows which existing files the fixed parser treats as suspicious.

Sizing exposure and applying the fix

Internet measurement can size the population without identifying the vulnerable subset. At the time of writing, ZoomEye returned 116,266 assets for an NSD application match and 628,831 for a looser banner match, while a query tied to CVE-2026-101338 returned zero shortly after disclosure. None of these figures reveal version, deployment role, or whether a server accepts zone uploads.

Remediation is an upgrade to NSD 4.15.3, distributed by NLnet Labs as a source tarball. Where the release cannot be deployed immediately, the vendor publishes per-CVE diffs against 4.15.2 that can be applied from the source directory and rebuilt. After a restart, operators should confirm the live process reports the fixed build. For fleets, the write-up prefers replacing images or packages over patching running hosts, so the change is reproducible and the version is auditable.

Why it matters

Authoritative DNS servers are force multipliers: one process compromise becomes forged answers for every hosted domain, cached by resolvers across the internet and replicated to secondaries through normal transfers. The attack path here requires a crafted file rather than a network packet, which favours attackers who already hold some access, whether a DNS panel customer, a CI pipeline, or an admin account. That makes the trust boundary around zone-file authorship, not just the CVSS score, the right basis for patch priority. The fixed parser also doubles as a detection tool, letting operators audit existing zones before they upgrade.